CVE-2021-23434

This affects the package object-path before 0.11.6. A type confusion vulnerability can lead to a bypass of CVE-2020-15256 when the path components used in the path parameter are arrays. In particular, the condition currentPath === '__proto__' returns false if currentPath is ['__proto__']. This is because the === operator returns always false when the type of the operands is different.

• CWE-843

• https://github.com/mariocasciaro/object-path%230116Broken Link
• https://github.com/mariocasciaro/object-path/commit/7bdf4abefd102d16c163d633e8994ef154cab9ebPatch, Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2023/01/msg00031.htmlMailing List, Third Party Advisory
• https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1570423Exploit, Third Party Advisory
• https://snyk.io/vuln/SNYK-JS-OBJECTPATH-1569453Exploit, Third Party Advisory
• https://github.com/mariocasciaro/object-path%230116Broken Link
• https://github.com/mariocasciaro/object-path/commit/7bdf4abefd102d16c163d633e8994ef154cab9ebPatch, Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2023/01/msg00031.htmlMailing List, Third Party Advisory
• https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1570423Exploit, Third Party Advisory
• https://snyk.io/vuln/SNYK-JS-OBJECTPATH-1569453Exploit, Third Party Advisory

Published

Aug 27, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-23429All versions of package transpile are vulnerable to Denial o…7.5
• CVE-2021-2343Vulnerability in the Oracle Workflow product of Oracle E-Bus…4.3
• CVE-2021-23430All versions of package startserver are vulnerable to Direct…7.5
• CVE-2021-23431The package joplin before 2.3.2 are vulnerable to Cross-site…8.8
• CVE-2021-23432This affects all versions of package mootools. This is due t…9.8
• CVE-2021-23433The package algoliasearch-helper before 3.6.2 are vulnerable…9.8
• CVE-2021-23435This affects the package clearance before 2.5.0. The vulnera…6.1
• CVE-2021-23436This affects the package immer before 9.0.6. A type confusio…9.8
• CVE-2021-23437The package pillow 5.2.0 and before 8.3.2 are vulnerable to …7.5
• CVE-2021-23438This affects the package mpath before 0.8.4. A type confusio…9.8
• CVE-2021-23439This affects the package file-upload-with-preview before 4.2…6.1
• CVE-2021-2344Vulnerability in the Oracle Coherence product of Oracle Fusi…7.5